Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 12:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 6.5MB
- Sample260804-n97ayszbja
- SHA256 39695954a6a8a54b1193844629c968b592ae3249b9b8751fb2eb5dc628634c13
- MD5 4a76ad28c73c49f57867c1561309a624
- SHA1 e1d5d1c4bbd4ee0b43ca221d05c632a2422edde7
- SHA512 c6dede97fcd13aa471d954fd1237d82af3dd42b80fa2004437e73bf0b314b5b49ee28986bf167105cac97a8acb67805baa0bf4c0ea407578cf382ccb0e17a923
- SSDEEP 98304:eUqBmC5Dh7HObojhYzD7/eSmo6igXOQhA0TpQ1ZfY3weZO+r:tC5Dh7Huojmz3eSmo6igXOQlb7OW
- TLSH T17266AEA9B6BC00D5D4ABC1BDC2825227E772B85517B057CF5A609AFA1F23BD01E7E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 2 ipinfo.io - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4900 cmd.exe 2984 cmd.exe 4056 cmd.exe 5972 cmd.exe 4408 cmd.exe - Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 4352 WMIC.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1656 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2876 WMIC.exe 2876 WMIC.exe 2876 WMIC.exe 2876 WMIC.exe 4352 WMIC.exe 4352 WMIC.exe 4352 WMIC.exe 4352 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2876 WMIC.exe Token: SeSecurityPrivilege 2876 WMIC.exe Token: SeTakeOwnershipPrivilege 2876 WMIC.exe Token: SeLoadDriverPrivilege 2876 WMIC.exe Token: SeSystemProfilePrivilege 2876 WMIC.exe Token: SeSystemtimePrivilege 2876 WMIC.exe Token: SeProfSingleProcessPrivilege 2876 WMIC.exe Token: SeIncBasePriorityPrivilege 2876 WMIC.exe Token: SeCreatePagefilePrivilege 2876 WMIC.exe Token: SeBackupPrivilege 2876 WMIC.exe Token: SeRestorePrivilege 2876 WMIC.exe Token: SeShutdownPrivilege 2876 WMIC.exe Token: SeDebugPrivilege 2876 WMIC.exe Token: SeSystemEnvironmentPrivilege 2876 WMIC.exe Token: SeRemoteShutdownPrivilege 2876 WMIC.exe Token: SeUndockPrivilege 2876 WMIC.exe Token: SeManageVolumePrivilege 2876 WMIC.exe Token: 33 2876 WMIC.exe Token: 34 2876 WMIC.exe Token: 35 2876 WMIC.exe Token: 36 2876 WMIC.exe Token: SeIncreaseQuotaPrivilege 2876 WMIC.exe Token: SeSecurityPrivilege 2876 WMIC.exe Token: SeTakeOwnershipPrivilege 2876 WMIC.exe Token: SeLoadDriverPrivilege 2876 WMIC.exe Token: SeSystemProfilePrivilege 2876 WMIC.exe Token: SeSystemtimePrivilege 2876 WMIC.exe Token: SeProfSingleProcessPrivilege 2876 WMIC.exe Token: SeIncBasePriorityPrivilege 2876 WMIC.exe Token: SeCreatePagefilePrivilege 2876 WMIC.exe Token: SeBackupPrivilege 2876 WMIC.exe Token: SeRestorePrivilege 2876 WMIC.exe Token: SeShutdownPrivilege 2876 WMIC.exe Token: SeDebugPrivilege 2876 WMIC.exe Token: SeSystemEnvironmentPrivilege 2876 WMIC.exe Token: SeRemoteShutdownPrivilege 2876 WMIC.exe Token: SeUndockPrivilege 2876 WMIC.exe Token: SeManageVolumePrivilege 2876 WMIC.exe Token: 33 2876 WMIC.exe Token: 34 2876 WMIC.exe Token: 35 2876 WMIC.exe Token: 36 2876 WMIC.exe Token: SeIncreaseQuotaPrivilege 4352 WMIC.exe Token: SeSecurityPrivilege 4352 WMIC.exe Token: SeTakeOwnershipPrivilege 4352 WMIC.exe Token: SeLoadDriverPrivilege 4352 WMIC.exe Token: SeSystemProfilePrivilege 4352 WMIC.exe Token: SeSystemtimePrivilege 4352 WMIC.exe Token: SeProfSingleProcessPrivilege 4352 WMIC.exe Token: SeIncBasePriorityPrivilege 4352 WMIC.exe Token: SeCreatePagefilePrivilege 4352 WMIC.exe Token: SeBackupPrivilege 4352 WMIC.exe Token: SeRestorePrivilege 4352 WMIC.exe Token: SeShutdownPrivilege 4352 WMIC.exe Token: SeDebugPrivilege 4352 WMIC.exe Token: SeSystemEnvironmentPrivilege 4352 WMIC.exe Token: SeRemoteShutdownPrivilege 4352 WMIC.exe Token: SeUndockPrivilege 4352 WMIC.exe Token: SeManageVolumePrivilege 4352 WMIC.exe Token: 33 4352 WMIC.exe Token: 34 4352 WMIC.exe Token: 35 4352 WMIC.exe Token: 36 4352 WMIC.exe Token: SeIncreaseQuotaPrivilege 4352 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4056 4928 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 90 PID 4056 wrote to memory of 2876 4056 cmd.exe 92 PID 4928 wrote to memory of 5972 4928 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 94 PID 4928 wrote to memory of 4408 4928 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 96 PID 4408 wrote to memory of 4352 4408 cmd.exe 98 PID 4928 wrote to memory of 4900 4928 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 99 PID 4900 wrote to memory of 1656 4900 cmd.exe 101 PID 4900 wrote to memory of 4616 4900 cmd.exe 102 PID 4928 wrote to memory of 2984 4928 2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 103 PID 2984 wrote to memory of 4472 2984 cmd.exe 105 - cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 2 curl/8.8.0
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_4a76ad28c73c49f57867c1561309a624_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SYSTEM32\cmd.execmd /C "wmic os get Caption,Version /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption,Version /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "ver"2⤵
- Executes a command shell one-liner
PID:5972
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "wmic logicaldisk get size,freespace,caption"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get size,freespace,caption3⤵
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "ipconfig | findstr IPv4"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\system32\ipconfig.exeipconfig3⤵
- Gathers network information
PID:1656
-
-
C:\Windows\system32\findstr.exefindstr IPv43⤵PID:4616
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "curl -s https://ipinfo.io/json"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\curl.execurl -s https://ipinfo.io/json3⤵PID:4472
-
-